[RFC] Security: 12 vulnerabilities (critical)

[git-steer]

RFC: Security Vulnerability Remediation

Repository: ry-ops/unifi-mcp-server
Severity: CRITICAL
Date: 2026-02-15
Generated by: git-steer autonomous security sweep

Vulnerabilities

CVE	Package	Severity	Current	Fix Version
CVE-2026-21441	urllib3	HIGH	>= 1.22, < 2.6.3	2.6.3
CVE-2025-66471	urllib3	HIGH	>= 1.0, < 2.6.0	2.6.0
CVE-2025-66418	urllib3	HIGH	>= 1.24, < 2.6.0	2.6.0
CVE-2025-66416	mcp	HIGH	< 1.23.0	1.23.0
CVE-2025-62727	starlette	HIGH	>= 0.39.0, <= 0.49.0	0.49.1
CVE-2025-54121	starlette	MEDIUM	< 0.47.2	0.47.2
CVE-2025-53366	mcp	HIGH	< 1.9.4	1.9.4
CVE-2025-53365	mcp	HIGH	< 1.10.0	1.10.0
CVE-2025-50182	urllib3	MEDIUM	>= 2.2.0, < 2.5.0	2.5.0
CVE-2025-50181	urllib3	MEDIUM	< 2.5.0	2.5.0
CVE-2024-47081	requests	MEDIUM	< 2.32.4	2.32.4
CVE-2025-43859	h11	CRITICAL	< 0.16.0	0.16.0

Code Scanning Alerts

Rule	Severity	File	Line
actions/unpinned-tag	medium	.github/workflows/docker-build-push.yml	64
actions/unpinned-tag	medium	.github/workflows/docker-build-push.yml	50
actions/unpinned-tag	medium	.github/workflows/docker-build-push.yml	42
actions/unpinned-tag	medium	.github/workflows/claude.yml	31
actions/unpinned-tag	medium	.github/workflows/docker-build-push.yml	39

Change Plan

1. Update vulnerable dependencies to patched versions
2. Run automated tests to verify compatibility
3. Create PR with fixes
4. Merge after review

Risk Assessment

• Impact of not fixing: Potential security breach via known CVEs
• Impact of fix: Dependency version bumps, low risk of breakage
• Rollback plan: Revert PR if tests fail

---

This RFC was auto-generated by git-steer. A fix PR will be created automatically.

[ry-ops]

RFC closed by PR #36 (merged at 6210270)

All 10 open Dependabot alerts addressed in a single consolidated change:

Package	Patched to	CVEs closed
urllib3	2.7.0	CVE-2026-44431, CVE-2026-44432
python-multipart	0.0.27	CVE-2026-42561, CVE-2026-40347
cryptography	46.0.7 (resolved: 48.0.0)	CVE-2026-39892, CVE-2026-34073
requests	2.33.0 (resolved: 2.34.2)	CVE-2026-25645
python-dotenv	1.2.2	CVE-2026-28684
Pygments	2.20.0	CVE-2026-4539
idna	3.15 (resolved: 3.16)	CVE-2026-45409

Side benefit: PR #36 also repaired pyproject.toml — six dependency lines had a stray >=" injected by an earlier auto-fix (e.g. "httpx>=">=0.28.1"), making the manifest unparseable. The previous git-steer auto-PRs (#27–#30) only modified SECURITY_FIXES.md rather than the actual manifest, which is why this had to be fixed by hand.

PRs closed as obsolete:

• Duplicate/empty git-steer PRs: [git-steer] Security: Fix 6 CVE(s) #27, [git-steer] Security: Fix 6 CVE(s) #28, [git-steer] Security: Fix 6 CVE(s) #29, [git-steer] Security: Fix 6 CVE(s) #30
• Mismatched body/diff (Copilot): Security: pin actions/checkout to SHA and bump vulnerable Python deps #13
• Narrower scope, superseded: [git-steer] Security: Fix 5 CVE(s) #24
• Dependabot individual-dep PRs: Bump requests from 2.32.5 to 2.33.0 #14, Bump pygments from 2.19.2 to 2.20.0 #16, Bump cryptography from 46.0.5 to 46.0.7 #17, Bump python-multipart from 0.0.22 to 0.0.26 #18, Bump python-dotenv from 1.2.1 to 1.2.2 #19

Closing this RFC.